Pi-hole FTL CVE-2026-39849

Exploitation requires network access to the Pi-hole configuration API (typically HTTP/HTTPS on the web interface). In installations with no admin password set - explicitly described as the default for many deployments - the API is accessible without authentication, enabling remote unauthenticated exploitation (effectively PR:N despite CVSS rating PR:L). In password-protected deployments, the attacker needs valid admin credentials (PR:L). The attacker must inject the malicious configuration, enable the built-in DHCP server feature via the API, and wait for any device on the network to request a DHCP lease, which occurs automatically during normal network operations (device boot, lease renewal cycles). The 31-byte strncpy limit requires compact payloads but is not a practical barrier given example payloads like wlan0\ndhcp-script=/tmp/p fit within constraints. No specific Pi-hole features beyond the configuration API need to be enabled initially, though the DHCP server must be activated as part of the attack chain.

CVSS 8.7 reflects high confidentiality, integrity, and availability impacts with low attack complexity and network attack vector, but the PR:L (low privileges required) rating understates real-world risk in default configurations. The description explicitly states 'no admin password set (the default for many deployments)' exposes the configuration API without credentials, effectively making this PR:N (no privileges required) in common deployments. The 31-byte payload constraint is NOT a practical limitation - the provided example dhcp-script injection fits comfortably. EPSS and KEV data not provided, but the combination of (1) authentication bypass in default configs, (2) persistent configuration injection surviving reboots, (3) remote network vector, and (4) RCE tag suggests high real-world exploitation potential. The requirement for DHCP activity to trigger execution adds a timing dependency but is trivially satisfied in typical network environments where devices regularly renew leases. Vendor-confirmed fix in 6.6.1 and detailed GitHub security advisory (GHSA-9cqv-839p-gpq2) indicate this was responsibly disclosed and patched. Priority should be elevated for internet-exposed Pi-hole instances or those on untrusted network segments, particularly given Pi-hole's role as network infrastructure with privileged access to DNS/DHCP traffic.

A network-adjacent attacker on the same LAN as a default-configured Pi-hole (no admin password) sends HTTP POST requests to the configuration API to inject wlan0\ndhcp-script=/tmp/rce into the dns.interface field, which persists to /etc/pihole/pihole.toml. The attacker then enables the DHCP server via the same API. When any device on the network requests or renews a DHCP lease (a normal automatic event), dnsmasq executes /tmp/rce with root privileges, granting the attacker full control of the Pi-hole host and visibility into all network DNS traffic.